dchest

74 ms·

841.
by dchest 10y ago
Wow, do you know the laws of all countries?
842.
by dchest 10y ago
Picture time! More surface (both spiped and ssh are accepting connections): | → |ssh | → |spiped Less surface (spipe accepts connection, ssh is behind it): | → | spiped ↝ | ssh |
843.
by dchest 10y ago
If you ever find a service that is stupid enough to send password by email, but smart enough to store it hashed, please let me know. Also, you missed a part of my comment where I said that they sent passwords by email when you clicked &quot
844.
by dchest 10y ago
The question was if MITM would be able to prevent automatic update notifications. Their solution doesn't solve this: it prevents attackers from changing version information, but doesn't prevent them from replaying previous version
845.
by dchest 10y ago
Of course it's per user. What I meant is that it shouldn't be per user, it should be per password. If a user changes his password, he should get a new salt.
846.
by dchest 10y ago
Ideal salt is a large (e.g. 16 bytes or more) random byte string generated for each password. If there's a reason for it (in most cases, there is none), some trade offs are possible, e.g.: Salt is a large random string unique per user
847.
by dchest 10y ago
Rather than expecting the password hash library to store something into your application DB, you should be managing the access to that DB yourself. You do manage it yourself. Password hashing library doesn't access your database, it
848.
by dchest 10y ago
Yes, they usually produce a string that looks something like "salt||hash". (Salt is a non-secret value.) This result of bcrypt: $2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy |/ \| \____________________
849.
by dchest 10y ago
How is this a failure? That's correct. (If your password hashing library doesn't handle this automatically, of course. But it does the same internally.)
850.
by dchest 10y ago
No, in 2007 they even sent your password to email immediately after creating account: https://twitter.com/dchest/status/739804779296219136 There was also "remind password" feature: https://twi
851.
by dchest 10y ago
Nope, it is much better for those who use passwords with good entropy.
852.
by dchest 10y ago
Yes.
853.
by dchest 10y ago
This is a partial fix, but it's not enough. An attacker performing man-in-the-middle attack can respond with the previous version of "version information file", preventing the update. Imagine if there's a vulnerability i
854.
by dchest 10y ago
Seriously? How "we're going to take your money and if you don't like it, you can move somewhere else" is even remotely close to being a voluntary choice in your mind? You can try establishing some moral principles that w
855.
by dchest 10y ago
So I am quite happy to return the favour. It's great that you're happy, but you don't have a choice. You'll go to jail if you don't "return favour". I also want to live in a society that is compassionat
856.
by dchest 10y ago
And it's open source: https://github.com/mailru/icqdesktop
857.
by dchest 10y ago
:-) Yeah
858.
by dchest 10y ago
No, let's skip technical details and your opinion about frameworks as code sharing primitive and get back to your words. You literally claimed that while Wil made money "leaning heavily on some of the most well-designed frameworks
859.
by dchest 10y ago
Firefox works fine with it: http://jandemooij.nl/blog/2015/12/29/wx-jit-code-enabled-in-... After that, the performance overhead was pretty small on all benchmarks and websites I tested: Kraken and Octa
860.
by dchest 10y ago
No http://jandemooij.nl/blog/2015/12/29/wx-jit-code-enabled-in-...
861.
by dchest 10y ago
You are misrepresenting his argument about frameworks. Re-read the first paragraph of his post: "Apple's shared frameworks are very useful for sharing executable code and its associated resources among multiple applications, but w
862.
by dchest 10y ago
This comment by tptacek pretty much answers your question: "Schneier's career has an interesting arc that is not too dissimilar from that of Eric Raymond, involving early modest-but-significant contributions to the field (cryptolo
863.
by dchest 10y ago
Why?
864.
Swift and Dynamism(blog.wilshipley.com)
86 points by dchest 10y ago|41 comments
865.
Don't use VPN(gist.github.com)
1 points by dchest 10y ago|0 comments
866.
by dchest 10y ago
"Bublé is so funny. Remember Babel started out as "Traceur output is too complex!" Over time they learned that being spec-compliant matters." — Domenic Denicola (@dominic, Editor of the @htmlstandard and @streamstandard.
867.
by dchest 10y ago
Or Go, Dart, TypeScript, PureScript, Elm, CoffeeScript, Oberon, or any other language which can be compiled to it.
868.
by dchest 10y ago
GitLab too.
869.
by dchest 10y ago
I'm familiar with it. CTR DRBG, Hash DRBG, HMAC DRBG are all fairly solid designs.
870.
by dchest 10y ago
Apple's developer responsible for maintaining Git wrote that the fixed version didn't make it into Xcode 7.3, because the vulnerability was announced later than they released it [1][2]. It took some time to release 7.3.1, indeed,

More ›